Verifiable federated learning method and system based on multi-key fully homomorphic encryption

Abstract

The application discloses a verifiable federated learning method and system based on multi-key full homomorphic encryption, and relates to the technical fields of federated learning and encryption algorithm. The method comprises the following steps: encrypting the parameters of an initial global model, homomorphically committing the parameters of the initial global model; training the encrypted initial global model to obtain a local training model and a committed local training model; performing homomorphic multiplication operation on the parameters of the local training model; performing homomorphic aggregation on the mixed encrypted model parameters and the committed local training model; partially decrypting and globally decrypting the parameters of the updated global model; and verifying the target global model. According to the application, the data of the federated learning server and the client are homomorphically committed and multi-key full homomorphic encrypted, so that any party cannot obtain the data or model parameters of the other party in the whole model training process, thereby protecting the privacy of the participating parties, and the effectiveness of the whole calculation process is verified by opening the commitment of the final model.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of federated learning and encryption algorithm, in particular to a verifiable federated learning method based on multi-key homomorphic encryption and a system thereof. BACKGROUND

[0002] Federated Learning (FL) as an important branch of distributed machine learning has shown great application potential in medical image analysis, financial risk control, and intelligent Internet of Things since it was proposed by Google in 2016. Its core idea is to achieve the privacy protection goal of "data not moving and model moving" through the cooperation mode of local training by the client and parameter aggregation by the server. According to the statistics of IDC, as of 2023, more than 60% of enterprises use federated learning architecture when deploying AI models, especially in the medical field (such as cross-hospital electronic medical record analysis) with a growth rate of 45%. However, the actual landing of federated learning faces two major challenges: data privacy leakage risk and lack of model update verifiability.

[0003] In terms of privacy protection, traditional federated learning only achieves surface privacy by "not transmitting original data", but research shows that attackers can reconstruct sensitive information from model parameters through model inversion or membership inference attacks. For example, existing technologies have proven that from the gradient updates of a medical diagnosis model, it can be inferred whether a patient has a specific disease with an accuracy rate of over 80%. This has led the European Union's General Data Protection Regulation (GDPR) to classify model parameters as "potentially identifiable information", requiring enterprises to take technical measures to ensure the verifiability and privacy protection of the training process.

[0004] Homomorphic Encryption (HE) technology (such as BGV, CKKS scheme) allows direct calculation on ciphertext, but traditional schemes rely on a single key system. In the federated learning scenario, this means that all clients must share the same key, or rely on a trusted third party to generate the key. The former leads to centralized key leakage risk, and the latter introduces a centralized trust assumption. If the server's public key is used for data encryption, the server can decrypt it, and some schemes set up multiple servers to negotiate with each other, which will additionally increase the complexity and make major changes to the overall system architecture. More importantly, a single key system cannot support cross-client ciphertext interaction calculation. For example, when client A uses key pk_A to encrypt parameters and client B uses pk_B to encrypt parameters, existing HE schemes cannot directly aggregate the two ciphertexts, and must use a complex key switching protocol, resulting in a large amount of additional communication overhead.

[0005] In addition to privacy protection, federated learning also needs to ensure that the model updates submitted by the clients meet the preset rules (such as training using compliant data). Existing verifiability solutions are mainly based on zero-knowledge proof (ZKP) and trusted execution environment (TEE), but these methods have problems such as narrow scope of application and strong hardware dependency. In recent years, academia has tried to combine the above technologies to break through the limitations of single solutions, but the key bottlenecks have not been solved.

[0006] In summary, existing federated learning privacy protection solutions face three contradictions:

[0007] 1) Trade-off between security and efficiency: Strengthening privacy protection often leads to a sharp decline in computing efficiency, making it difficult to meet the real-time requirements of medical diagnosis and other scenarios with high requirements.

[0008] 2) Multi-party collaboration and lack of trust: Cross-institutional federated learning needs to eliminate the centralized trust assumption, but existing encryption solutions rely on a single authoritative node to generate keys or parameters.

[0009] 3) Insufficient verifiability and traceability: Lack of lightweight mechanisms to simultaneously verify the correctness of the computing process and the authenticity of the data source, making it difficult to quickly locate model bias.

[0010] These defects seriously restrict the large-scale application of federated learning in high-value scenarios such as finance and medicine. For example, when multiple hospitals jointly train a tumor prediction model, it is necessary to prevent patient privacy leakage and verify whether each hospital uses compliant data (such as excluding unauthorized image data), and existing technologies have not yet provided a feasible solution. SUMMARY

[0011] In this context, the present invention attempts to solve the above problems through the innovative integration of multi-key fully homomorphic encryption and homomorphic commitment, suitable for distributed machine learning in privacy-sensitive scenarios such as medicine and finance.

[0012] The purpose of the embodiments of the present application is to provide a multi-key fully homomorphic encryption-based verifiable federated learning method and system, which encrypts the initialization of the global model parameters of the federated learning server and the data of the federated learning clients using the homomorphic commitment and multi-key fully homomorphic encryption scheme, so that during the entire model training and updating iteration process, any party cannot obtain the data or model parameters of the other party, thereby protecting the privacy of the participating parties.

[0013] To achieve the above object, the first aspect of the present application provides a verifiable federated learning method based on multi-key fully homomorphic encryption, applied to a federated learning server and a plurality of federated learning clients, the verifiable federated learning method comprising: on the federated learning server, encrypting parameters of an initial global model using a first public key to obtain an encrypted initial global model, and homomorphically committing the parameters of the initial global model using a homomorphic commitment algorithm to obtain a commitment disclosure of the initial global model, wherein the federated learning server sends the encrypted initial global model and the commitment disclosure of the initial global model to the plurality of federated learning clients; on each federated learning client, training the encrypted initial global model based on own data to obtain a local training model, and training the encrypted initial global model based on committed own data to obtain a committed local training model, wherein the committed own data is obtained by homomorphically committing the own data using the homomorphic commitment algorithm; on the each federated learning client, performing homomorphic multiplication operation on parameters of the local training model using a second public key to obtain a hybrid encrypted model, wherein the first public key and the second public key are generated based on a multi-key fully homomorphic encryption key generation algorithm; on the federated learning server, homomorphically aggregating parameters of the hybrid encrypted model sent by the each federated learning client to obtain an updated global model, and homomorphically aggregating the committed local training models sent by the each federated learning client to obtain a committed updated global model; in the case that the updated global model meets a set condition, partially decrypting parameters of the updated global model using a second private key corresponding to the second public key by the each federated learning client, and globally decrypting using a first private key corresponding to the first public key by the federated learning server, to obtain a target global model; and verifying the target global model based on the committed updated global model.

[0014] Another aspect of the present application provides a verifiable federated learning system based on multi-key fully homomorphic encryption, comprising a federated learning server and a plurality of federated learning clients, the federated learning server being configured to perform the following functions: encrypting parameters of an initial global model using a first public key to obtain an encrypted initial global model, and homomorphically committing the parameters of the initial global model using a homomorphic commitment algorithm to obtain a commitment public of the initial global model; sending the encrypted initial global model and the commitment public of the initial global model to the plurality of federated learning clients, and receiving a hybrid encrypted model and a committed local training model sent by the plurality of federated learning clients; homomorphically aggregating parameters of the hybrid encrypted model to obtain an updated global model, and homomorphically aggregating the committed local training model to obtain a committed updated global model; receiving parameters of the updated global model partially decrypted by each federated learning client, and globally decrypting the partially decrypted parameters using a first private key corresponding to the first public key to obtain a target global model; and verifying the target global model based on the committed updated global model.

[0015] Another aspect of the present application provides a verifiable federated learning system based on multi-key fully homomorphic encryption, comprising a federated learning server and a plurality of federated learning clients, each of the plurality of federated learning clients being configured to perform the following functions: receiving an encrypted initial global model and a commitment public of an initial global model sent by the federated learning server; training the encrypted initial global model based on own data to obtain a local training model, and training the encrypted initial global model based on committed own data to obtain a committed local training model, wherein the committed own data is obtained by homomorphically committing the own data using the homomorphic commitment algorithm; performing homomorphic multiplication operation on parameters of the local training model using a second public key to obtain a hybrid encrypted model, wherein the first public key and the second public key are generated based on a multi-key fully homomorphic encryption key generation algorithm; sending the hybrid encrypted model and the committed local training model to the federated learning server, and receiving an updated global model and a committed updated global model sent by the federated learning server; in a case where the updated global model satisfies a set condition, partially decrypting parameters of the updated global model using a second private key corresponding to the second public key, and sending the partially decrypted parameters of the updated global model to the federated learning server to obtain a target global model; and verifying the target global model based on the committed updated global model.

[0016] By the technical scheme, the method encrypts the initialization global model parameters of the federated learning server and the data of the federated learning client by homomorphic commitment and a multi-key full homomorphic encryption scheme, so that in the whole model training and updating iteration process, any party cannot obtain the data or model parameters of the other party, thereby protecting the privacy of the participating parties; meanwhile, the homomorphic nature of the homomorphic commitment scheme is utilized, so that if any participating party has doubts about the final model, the effectiveness of the whole calculation process can be verified by opening the commitment of the final model.

[0017] Compared with the prior art, the application has the advantages that: first, the framework structure of the federated learning is not changed, and any federated learning client only needs to interact with a unique federated learning server; second, the security and privacy protection are high, and any participating party cannot obtain the data, initial model parameters, intermediate model parameters and even final model parameters of the other party without authorization.

[0018] Other features and advantages of the embodiments of the present application will be described in detail in the following specific implementation part. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings are included to provide a further understanding of the embodiments of the present application, and constitute a part of the specification, and are used together with the following specific implementation to explain the embodiments of the present application, but do not constitute a limitation on the embodiments of the present application. In the drawings:

[0020] Figure 1 A flowchart of a verifiable federated learning method based on multi-key full homomorphic encryption according to an embodiment of the present application is shown;

[0021] Figure 2 An execution logic diagram of the verifiable federated learning method based on multi-key full homomorphic encryption according to an embodiment of the present application is shown;

[0022] Figure 3 A structure diagram of a verifiable federated learning system based on multi-key full homomorphic encryption according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical scheme and advantages of the embodiments of the present application more clear, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiments of the present application, and is not used to limit the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without making creative efforts fall within the scope of protection of the present application.

[0024] It should be noted that if the application embodiments involve directionality indications (such as up, down, left, right, front, back, etc.), the directionality indications are only used to explain the relative position relationship, movement condition, etc. between components in a certain posture (as shown in the drawings), and if the certain posture changes, the directionality indications will also change accordingly.

[0025] In addition, if the application embodiments involve descriptions such as "first", "second", etc., the descriptions of "first", "second", etc. are only for description purposes and cannot be understood as indicating or implying the relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined as "first", "second" can explicitly or implicitly include at least one of the features. In addition, the technical solutions of each embodiment can be combined with each other, but it must be based on the realization of a person skilled in the art, and when the combination of technical solutions contradicts each other or cannot be realized, it should be considered that the combination of technical solutions does not exist and is not within the protection scope required by the application.

[0026] First, the application embodiments provide a verifiable federated learning method based on multi-key full homomorphic encryption, which can be applied to a federated learning server and a plurality of federated learning clients. As shown in the flowchart of Figure 1 The verifiable federated learning method 100 can include steps S110-S160 as shown in the flowchart.

[0027] Step S110, on the federated learning server, encrypting the parameters of the initial global model using a first public key to obtain an encrypted initial global model, and homomorphically committing the parameters of the initial global model using a homomorphic commitment algorithm to obtain a commitment public of the initial global model.

[0028] Among them, the federated learning server can send the encrypted initial global model and the commitment public of the initial global model to the plurality of federated learning clients. In addition, the federated learning server can determine the initial global model in a random generation manner or a selection of existing model manner.

[0029] Among them, the homomorphic commitment algorithm can include:

[0030] Define CommSetup(λ) as the initialization process of the homomorphic commitment algorithm, Comm(r,x) as the commitment process of the homomorphic commitment algorithm, and Open(r,x) as the opening process of the homomorphic commitment algorithm, wherein λ is the security parameter of the homomorphic commitment algorithm, and r and x are random numbers and data to be committed, respectively;

[0031] The federated learning server performs the initialization process CommSetup(λ) to generate a first public parameter, and shares the first public parameter with each federated learning client to obtain a second public parameter;

[0032] For example, the homomorphic commitment algorithm is a Pedersen commitment based on an elliptic curve, and the public parameters are (q, g, h), including: the first public parameters q, g, and the second public parameters h.

[0033] The public parameters (q, g, h) can be determined in the following manner:

[0034] On the federated learning server, the first public parameters q, g are determined based on the elliptic curve q-th power group and the generator g of the group, and the first public parameters are shared to each federated learning client;

[0035] On each federated learning client i, a group element h is randomly selected according to the first public parameters i The group element h i is disclosed and shared to the federated learning server; and

[0036] The federated learning server obtains all the (h i ) i∈[N] shared by the federated learning clients, determines the value of h = h1·h2…h N as the second public parameters, and discloses and shares the second public parameters to all the federated learning clients.

[0037] For all the data x i,j of each federated learning client itself, a corresponding random number r i,j is generated; and

[0038] Each data x i,j is committed by the corresponding random number r i,j through the Comm(r, x) algorithm to obtain the corresponding commitment value σ i,j of each data x i,j , and the commitment value σ i,j is disclosed.

[0039] The homomorphic commitment algorithm should also satisfy:

[0040] For any message x and random number r, σ <- Comm(r, x), before the commitment party provides x and r to open the commitment σ, no one else can know anything about x;

[0041] After the commitment σ is generated, the commitment party cannot provide other messages and random numbers to satisfy x ≠ x' or r ≠ r', so that σ = Open(r', x').

[0042] Step S120, on each federated learning client, training the encrypted initial global model based on the self data to obtain a local training model, and training the encrypted initial global model based on the committed self data to obtain a committed local training model.

[0043] The committed self data is obtained by homomorphically committing the self data using a homomorphic commitment algorithm. For example, if the encrypted model parameters are subjected to homomorphic addition operations, the commitments of the two parameters are also subjected to homomorphic addition operations, ensuring that the output of the model parameters can match the output of the commitment.

[0044] It should be noted that the "encrypted initial global model" and the "committed public initial global model" are the same model. If the original initial global model is public, the model parameters need to be encrypted and sent out, and the model parameters need to be committed, which will obtain two parts of the encrypted global model and the commitment of the global model.

[0045] Step S130, on each federated learning client, using a second public key to perform homomorphic multiplication operations on the parameters of the local training model to obtain a hybrid encrypted model. The first public key and the second public key are generated based on a multi-key full homomorphic encryption key generation algorithm.

[0046] In step S130, using the second public key to perform homomorphic multiplication operations on the parameters of the local training model can include:

[0047] 1) After obtaining the parameters of the local training model, encrypt the value 1 using the second public key to obtain a feature ciphertext; and

[0048] 2) Multiply the feature ciphertext with each parameter of the local training model to obtain a hybrid encrypted model.

[0049] It should be noted that the method of the present application is to protect the privacy of the initial and intermediate model parameters, and not to limit the protection of the privacy of the final model parameters, because the final model parameters must be given to the server for use. Among them, the initial model parameters are selected by the server, and therefore cannot be disclosed to the client; at the same time, the intermediate model parameters cannot be known by the client and the server, because the intermediate model parameters contain more specific client data information. For example, the model update obtained by the server in the first round is not the same for each client, and when the server aggregates, these model updates are averaged by each client, which can play a certain protection role; if not aggregated, the server can directly know the first round model update parameter returned by a certain client, and then it is easy to deduce back to the data of this client. Therefore, the present application needs to limit that each client uses a ciphertext of 1 multiplied by the model parameter, so that the server itself cannot decrypt the data sent by the client, and the privacy protection is realized.

[0050] Step S140, on the federated learning server, homomorphically aggregate the parameters of the mixed encrypted model sent by each federated learning client to obtain an updated global model, and homomorphically aggregate the committed local training model sent by each federated learning client to obtain a committed updated global model.

[0051] Step S150, in the case where the updated global model satisfies a set condition, the parameters of the updated global model are partially decrypted by each federated learning client using a second private key corresponding to a second public key, and the global model is globally decrypted by the federated learning server using a first private key corresponding to a first public key, to obtain a target global model.

[0052] The set condition can include that the training iteration reaches a predetermined number of times or the updated global model reaches a convergence condition. The federated learning server determines the initial global model by randomly generating or selecting an existing model, and determines the predetermined number of times.

[0053] Step S160, verifying the target global model based on the committed updated global model.

[0054] In the embodiment of the present application, step S160 can include steps S161-S163:

[0055] Step S161, the federated learning server and the plurality of federated learning clients publicly disclose their own data or model parameters by using a homomorphic commitment algorithm.

[0056] Step S162, in the process of federated learning, the commitment property of the homomorphic commitment is used throughout the process, and the corresponding commitment is executed with the same calculation process as the model training, so as to obtain the commitment information corresponding to the final model parameter.

[0057] Step S163, in the case that the federated learning server and any participant in the federated learning client federation have objections to the model calculation process, the commitment is allowed to be opened, so as to verify the validity of the model parameter.

[0058] In summary, the present application aims to propose a verifiable federated learning method based on multi-key full homomorphic encryption, which can have the following beneficial effects:

[0059] The method encrypts the initialization global model parameter of the federated learning server and the data of the federated learning client by using the homomorphic commitment and the multi-key full homomorphic encryption scheme, so that in the training and updating iteration process of the whole model, any party cannot obtain the data or model parameter of the other party, thereby protecting the privacy of the participants; meanwhile, the homomorphic property of the homomorphic commitment scheme is used, so that if any participant has doubts about the final model, the commitment of the final model can be opened to verify the validity of the whole calculation process.

[0060] Compared with the prior art, the present application has the following advantages: first, the framework structure of the federated learning is not changed, and any federated learning client only needs to interact with the unique federated learning server; second, it has high security and privacy protection, and any participant cannot obtain the data, initial model parameter, intermediate model parameter or even final model parameter of the other party without authorization.

[0061] Reference Figure 2 , the execution logic schematic diagram of the verifiable federated learning method based on multi-key full homomorphic encryption of the present application is shown, which can specifically include the following steps S201-S210:

[0062] S201, set KeyGen(κ,i) as a key generation process of a multi-key full homomorphic encryption scheme, Enc(pk i ,x i ) as an encryption process of the encryption scheme, as a ciphertext calculation process of the encryption scheme, as a partial decryption process of the encryption scheme, as a final decryption process of the encryption scheme, wherein κ is a security parameter of the multi-key full homomorphic encryption scheme, i∈[N] is a user number, N is the total number of system users, pk i and sk i are the public key and private key generated for the user i by the key generation process, x i is the data to be encrypted, ct iThe encrypted ciphertext to be computed. The circuit for the function to be calculated. p is the ciphertext to be decrypted after calculation. i This is the partial decryption result obtained after partially decrypting user i; let CommSetup(λ) be the initialization process of a homomorphic commitment scheme, Comm(r,x) be the commitment process of the homomorphic commitment scheme, and Open(r,x) be the opening process of the homomorphic commitment scheme, where λ is the security parameter of the homomorphic commitment scheme, and r and x are the random number and the data to be committed, respectively;

[0063] S202. The federated learning server executes the initialization process CommSetup(λ) of the homomorphic commitment scheme, generates common parameters, and shares these common parameters with the federated learning client nodes. Taking the Pedersen commitment based on elliptic curves as an example, the common parameters are the q-order multiplicative group based on elliptic curves and the generator g of the group.

[0064] S203, Federated learning client i randomly selects group element h based on common parameters. i And then, the federated server makes it public through all federated learning clients (h i ) i∈[N] Calculate h = h1·h2…h N If q, g, h is given as another public parameter and made public to all federated learning clients, then the public parameters of the entire homomorphic commitment scheme are (q, g, h).

[0065] S204. Before federated learning begins, each federated learning client has access to all of its own data x. i,j All generate corresponding random numbers r i,j And through the homomorphic commitment scheme Comm(r i,j ,x i,j The algorithm commits to it and obtains the commitment value σ. i,j And make it public; at the same time, both the federated learning server and the client execute the key generation KeyGen(κ,i) of the multi-key fully homomorphic encryption scheme. i∈[0,N] The algorithm generates its own public and private key pairs (pk). i ,sk i ), where (pk0, sk0) is the public-private key pair of the federated learning server, (pk i ,sk i ) i∈[N] For the public / private key pair of the federal client i;

[0066] S205, at the beginning of federated learning, the federated learning server initializes a global model and prepares the number of iterations using a method of randomly generating or selecting an existing model, encrypts the global model parameters using its own public key pk0, and for each parameter in the model, generates a corresponding random number, commits all parameters using the Comm(·) algorithm of the homomorphic commitment scheme, and publishes the commitment of the global model parameters;

[0067] S206, the federated learning server sends the encrypted global model parameters to each federated learning client;

[0068] S207, after receiving the encrypted global model parameters, the federated learning client uses its own plaintext data to start local training on the global model parameters, and the training process uses the Eval(·) algorithm of the multi-key full homomorphic encryption scheme, and obtains an encrypted local training model; then, the federated learning client generates an encryption of the value 1, and performs homomorphic multiplication operation on all encrypted parameters in the encrypted local training model using the Eval(·) algorithm with the encryption of the value 1, to ensure that the parameters in the encrypted model are mixed with the public key information of the federated learning server and the federated learning client; at the same time, the federated learning client also uses the homomorphic property of the homomorphic commitment to perform the same operation as the training process to obtain the commitment of the local training model parameters;

[0069] S208, each federated learning client sends the local training model to the federated learning server, and after receiving all the local training models of the federated learning clients, the federated learning server aggregates the local training models into a new encrypted global model using the Eval(·) algorithm of the multi-key full homomorphic encryption scheme; at the same time, similar to S207, the federated learning server also updates the commitment of the global model using the homomorphic property of the homomorphic commitment;

[0070] S209, the federated learning server sends the updated global model parameters back to each federated learning client, and repeats the process of S206-S208 until the number of iterations reaches the predetermined number;

[0071] S210, the federated learning server sends the final global model parameters to each federated learning client, and each federated learning client uses its own private key and partial decryption algorithm PartDec(·) to decrypt the encrypted global model parameters and returns the partial decryption result to the federated learning server; after obtaining all the partial decryption results of the federated learning clients and its own, the federated learning server uses the final decryption algorithm FinDec(·) to obtain the decrypted final global model parameters.

[0072] The multi-key homomorphic encryption scheme in step S201 satisfies: for ciphertexts encrypted using different user public keys, arbitrary Eval(·) computation operations are supported thereon, thereby obtaining an encrypted computation result, and when decrypting the encrypted computation result, user private keys corresponding to all ciphertexts participating in the computation are required to first perform a partial decryption algorithm PartDec(·) to obtain a partial decryption result, and then input into a final decryption algorithm FinDec(·) to obtain a decrypted computation result, and before all users perform partial decryption using their own private keys, the plaintext information in the encrypted computation result cannot be obtained by any computing participant, thereby protecting the security and privacy of the federated learning client data and intermediate model parameters in the entire federated learning process.

[0073] The homomorphic commitment scheme in step S201 satisfies: 1) concealment, for any message x and random number r, σ←Comm(r,x), anyone cannot know anything about x before the committer provides x and r to open the commitment σ; 2) binding, after the commitment σ is generated, the committer cannot provide other messages and random numbers to satisfy x≠x′ or r≠r′, so that σ=Open(r′,x′).

[0074] Wherein, any federated learning client adopts local plaintext data to calculate the encrypted global model parameters generated by the federated learning server when performing local model training, thereby accelerating the calculation efficiency; at the same time, after obtaining the updated local model parameters, the local model data is processed using an encryption value of 1, so that all encrypted parameters are mixed with the public keys of the federated client and the server, thereby avoiding the federated learning server from obtaining the updated local model through decryption to deduce the training data of the federated learning client.

[0075] It should be emphasized that the verifiability of the scheme comes from the fact that the federated learning client and the server publicly disclose their data or model parameters through homomorphic commitment before model training, and the commitment property of the homomorphic commitment is used throughout the calculation process. The corresponding commitment is executed through the same calculation process as the model training, thereby obtaining commitment information corresponding to the final model parameters, and in the case that any participant has objections to the model calculation process, the commitment is allowed to be opened to verify the validity of the model parameters.

[0076] In summary, the application discloses a verifiable federated learning method based on multi-key fully homomorphic encryption, which encrypts the initial global model parameters of the federated learning server and the data of the federated learning client by using a homomorphic commitment and a multi-key fully homomorphic encryption scheme, so that in the training and updating iteration process of the whole model, any party cannot obtain the data or model parameters of the other party, thereby protecting the privacy of the participants; meanwhile, the homomorphic nature of the homomorphic commitment scheme is used, so that if any participant has doubts about the final model, the effectiveness of the whole calculation process can be verified by opening the commitment of the final model. Compared with the prior art, the method has the advantages that: first, the framework structure of the federated learning is not changed, and any federated learning client only needs to interact with the unique federated learning server; second, the method has high security and privacy protection, and any participant cannot obtain the data, initial model parameters, intermediate model parameters or even final model parameters of the other party without authorization.

[0077] On the other hand, the application also provides a verifiable federated learning system 300 based on multi-key fully homomorphic encryption, referring to Figure 3 which can include a federated learning server 310 and a plurality of federated learning clients 320, wherein the federated learning server 310 can be used to perform the following functions:

[0078] 1) encrypt the parameters of the initial global model using a first public key to obtain an encrypted initial global model, and homomorphically commit the parameters of the initial global model using a homomorphic commitment algorithm to obtain a commitment disclosure of the initial global model;

[0079] 2) send the encrypted initial global model and the commitment disclosure of the initial global model to the plurality of federated learning clients, and receive the hybrid encrypted model and the committed local training model sent by the plurality of federated learning clients;

[0080] 3) homomorphically aggregate the parameters of the hybrid encrypted model to obtain an updated global model, and homomorphically aggregate the committed local training model to obtain a committed updated global model;

[0081] 4) receive the parameters of the partial decryption of the updated global model by each federated learning client, and globally decrypt the partial decryption parameters using a first private key corresponding to the first public key to obtain a target global model; and

[0082] 5) verify the target global model based on the committed updated global model.

[0083] In addition, each federated learning client in the plurality of federated learning clients 320 can be used to perform the following functions:

[0084] 1) receiving an encrypted initial global model and a commitment public of the initial global model sent by a federated learning server;

[0085] 2) training the encrypted initial global model based on self data to obtain a local training model, and training the encrypted initial global model based on committed self data to obtain a committed local training model, wherein the committed self data is obtained by homomorphically committing the self data using a homomorphic commitment algorithm;

[0086] 3) performing homomorphic multiplication operation on parameters of the local training model using a second public key to obtain a mixed encrypted model, wherein the first public key and the second public key are generated based on a multi-key full homomorphic encryption key generation algorithm;

[0087] 4) sending the mixed encrypted model and the committed local training model to the federated learning server, and receiving an updated global model and a committed updated global model sent by the federated learning server;

[0088] 5) in the case that the updated global model satisfies a set condition, performing partial decryption on parameters of the updated global model using a second private key corresponding to the second public key, and sending the partially decrypted parameters of the updated global model to the federated learning server to obtain a target global model; and

[0089] 6) verifying the target global model based on the committed updated global model.

[0090] In summary, the present application aims to propose a verifiable federated learning system based on multi-key full homomorphic encryption, which can have the following beneficial effects:

[0091] The system encrypts the initialization global model parameters of the federated learning server and the data of the federated learning client using the homomorphic commitment and multi-key full homomorphic encryption scheme, so that during the training and updating iteration process of the entire model, any party cannot obtain the data or model parameters of the other party, thereby protecting the privacy of the participants; meanwhile, the homomorphic nature of the homomorphic commitment scheme is utilized, so that if any participant has doubts about the final model, the effectiveness of the entire calculation process can be verified by opening the commitment of the final model.

[0092] Compared with the prior art, the present application has the following advantages: first, the framework structure of the federated learning is not changed, and any federated learning client only needs to interact with a unique federated learning server; second, it has high security and privacy protection, and any participant cannot obtain the data, initial model parameters, intermediate model parameters or even final model parameters of the other party without authorization.

[0093] The beneficial effects of the verifiable federated learning system based on multi-key fully homomorphic encryption provided by the present application can refer to the above description of the verifiable federated learning method based on multi-key fully homomorphic encryption, and will not be repeated here.

[0094] It also needs to be explained that the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment. Without more limitations, the element defined by the statement "including a" does not exclude the presence of other identical elements in the process, method, article or equipment including the element.

[0095] The above is only an embodiment of the present application and is not intended to limit the present application. The present application can have various modifications and changes for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application shall be included in the scope of claims of the present application.

Claims

1. A method of verifiable federated learning based on multi-key fully homomorphic encryption, applied to a federated learning server and a plurality of federated learning clients, characterized in that, The verifiable federated learning method comprises: On the federated learning server, parameters of an initial global model are encrypted using a first public key to obtain an encrypted initial global model, and the parameters of the initial global model are homomorphically committed using a homomorphic commitment algorithm to obtain a commitment public of the initial global model, wherein the federated learning server sends the encrypted initial global model and the commitment public of the initial global model to the plurality of federated learning clients; On each federated learning client, the encrypted initial global model is trained based on self data to obtain a local training model, and the encrypted initial global model is trained based on committed self data to obtain a committed local training model, wherein the committed self data is obtained by homomorphically committing the self data using the homomorphic commitment algorithm; On the each federated learning client, the parameters of the local training model are homomorphically multiplied using a second public key to obtain a hybrid encrypted model, wherein the first public key and the second public key are generated based on a multi-key full homomorphic encryption key generation algorithm; On the federated learning server, the parameters of the hybrid encrypted model sent by the each federated learning client are homomorphically aggregated to obtain an updated global model, and the committed local training models sent by the each federated learning client are homomorphically aggregated to obtain a committed updated global model; In a case where the updated global model meets a set condition, the parameters of the updated global model are partially decrypted by the each federated learning client using a second private key corresponding to the second public key, and the federated learning server performs global decryption using a first private key corresponding to the first public key, to obtain a target global model; and The target global model is verified based on the committed updated global model.

2. The verifiable federated learning method of claim 1, wherein the homomorphic commitment algorithm comprises:

3. The verifiable federated learning method of claim 2, wherein the homomorphic commitment algorithm satisfies: Definitions an initialization procedure for the homomorphic commitment algorithm, a commitment procedure for the homomorphic commitment algorithm, an opening procedure for the homomorphic commitment algorithm, wherein, a security parameter for the homomorphic commitment algorithm, and respectively a random number and data to be committed. The federated learning server performs the initialization process to generate a first public parameter, and shares the first public parameter to each federated learning client to obtain a second public parameter; for all data of each federated learning client itself , a corresponding random number is generated ; and based on algorithm, each data is committed through its corresponding random number , to obtain the corresponding commitment value of each data , and the commitment value is disclosed.

4. The verifiable federated learning method of claim 2, wherein the homomorphic commitment algorithm satisfies: The homomorphic commitment algorithm is a Pedersen commitment based on an elliptic curve, and the public parameter is , including: a first public parameter , a second public parameter , wherein the public parameter is determined in the following manner : on the federated learning server, based on an elliptic curve Factorial group and generator of the group determining a first common parameter and sharing the first common parameter to each federated learning client; In each federated learning client Above, group elements are randomly selected based on the first common parameter. , the group elements Publicly shared with the federated learning server; and The federated learning server obtains the values of determined by all federated learning clients sharing as the second public parameter, and discloses and shares the second public parameter to all federated learning clients.

5. The verifiable federated learning method of claim 1, wherein the homomorphic multiplication of the parameters of the local training model using the second public key comprises, after obtaining the parameters of the local training model, encrypting a numerical value 1 using the second public key to obtain a feature ciphertext, and multiplying the feature ciphertext with each parameter of the local training model to obtain the hybrid encrypted model. The set condition comprises that a training iteration reaches a predetermined number of times or the updated global model reaches a convergence condition. For any message and a random number , When the Committer provides and to open the commitment Before that, no other party can learn anything about ; and On commitment After being generated, the committer cannot provide other messages and random numbers to satisfy Or So that . The federated learning server determines the initial global model by randomly generating or selecting an existing model, and determines the predetermined number of times. ​ 6. The verifiable federated learning method of claim 1, wherein, ​ 7. The verifiable federated learning method of claim 6, wherein, ​ 8. The verifiable federated learning method of claim 1, wherein, The commitment-based updated global model verifies the updated global model, including: the federated learning server and the plurality of federated learning clients publicly disclose their own data or model parameters through the homomorphic commitment algorithm; in the process of federated learning, the commitment property of the homomorphic commitment is used throughout the process, and the corresponding commitment performs the same calculation process as the model training, so as to obtain the commitment information corresponding to the final model parameter; and in the case that any participant in the federated learning server and the plurality of federated learning clients has objection to the model calculation process, the commitment is allowed to be opened, so as to verify the validity of the model parameter.

9. A verifiable federated learning system based on multi-key fully homomorphic encryption, comprising a federated learning server and a plurality of federated learning clients, characterized in that, The federated learning server is configured to perform the following functions: encrypt the parameters of an initial global model using a first public key to obtain an encrypted initial global model, and homomorphically commit the parameters of the initial global model using a homomorphic commitment algorithm to obtain a commitment disclosure of the initial global model; send the encrypted initial global model and the commitment disclosure of the initial global model to the plurality of federated learning clients, and receive a hybrid encrypted model and a committed local training model sent by the plurality of federated learning clients; homomorphically aggregate the parameters of the hybrid encrypted model to obtain an updated global model, and homomorphically aggregate the committed local training model to obtain a committed updated global model; receive parameters of the updated global model partially decrypted by the plurality of federated learning clients, and globally decrypt the partially decrypted parameters using a first private key corresponding to the first public key to obtain a target global model; and verify the target global model based on the committed updated global model.

10. A verifiable federated learning system based on multi-key fully homomorphic encryption, comprising a federated learning server and a plurality of federated learning clients, characterized in that, Each federated learning client in the plurality of federated learning clients is configured to perform the following functions: receive the encrypted initial global model and the commitment disclosure of the initial global model sent by the federated learning server; train the encrypted initial global model based on its own data to obtain a local training model, and train the encrypted initial global model based on committed own data to obtain a committed local training model, wherein the committed own data is obtained by homomorphically committing the own data using a homomorphic commitment algorithm; perform homomorphic multiplication operation on the parameters of the local training model using a second public key to obtain a hybrid encrypted model, wherein the second public key is generated based on a multi-key full homomorphic encryption key generation algorithm; send the hybrid encrypted model and the committed local training model to the federated learning server, and receive the updated global model and the committed updated global model sent by the federated learning server; in the case that the updated global model satisfies a set condition, partially decrypt the parameters of the updated global model using a second private key corresponding to the second public key, and send the partially decrypted parameters of the updated global model to the federated learning server to obtain a target global model; and verify the target global model based on the committed updated global model.

Images